detecting: malloc(-1) or malloc(0xffffffff)

Wed, 17 Sep 2014 17:25:16 +0000

In Suricata we’re often not printing malloc errors. The reason is that we’re not willing to print such errors based on (attacker controlled) traffic. So often such cases are silently handled.

We came across a bug though, where a integer underflow led to -1/0xffffffff being passed to malloc. Luckily, malloc just failed by returning NULL, and this return was properly handled. Still, passing such a large value to malloc is a bug, so I would like to catch it.

Speeding up Suricata with tcmalloc

Thu, 21 Oct 2010 12:10:33 +0000

’tcmalloc’ is a library Google created as part of the google-perftools suite for speeding up memory handling in a threaded program. It’s very simple to use and does work fine with Suricata. Don’t expect magic from it, but it should give you a few percent more speed.

On Ubuntu, install the libtcmalloc-minimal0 package:

apt-get install libtcmalloc-minimal0

Then run Suricata as follows (on a single line):

LD_PRELOAD="/usr/lib/libtcmalloc_minimal.so.0" ./src/suricata -c suricata.yaml -i eth0

Tcmalloc on Inliniac

detecting: malloc(-1) or malloc(0xffffffff)

Speeding up Suricata with tcmalloc